The Federal Trade Commission's consumer protection chief on Wednesday trumpeted the agency's efforts to uphold a data transfer pact between the European Union and U.S. government, as American officials pressed in Brussels to renew the agreement for a third year.

Andrew Smith, director of the FTC's bureau of consumer protection, pointed to the recent flurry of agency enforcement actions against U.S. companies accused of making false claims about their participation in the Privacy Shield agreement, a 2016 deal that allows data transfers from Europe to U.S. companies that pledge to comply with the framework's consumer protections.

While the framework is administered by the U.S. Department of Commerce, the FTC is tasked with ensuring that participating companies follow the Privacy Shield's data protection requirements—and that firms make accurate claims about their involvement in the program. Nearly 4,000 companies have self-certified their compliance with the framework's requirements, according to a database maintained by the International Trade Administration.

“It's an extremely important arrangement that Commerce and the [European Commission] have agreed to, and it supports hundreds of billions of dollars in transatlantic data flows. We at the FTC have an important role to play because we are the ones who are responsible for enforcing that Privacy Shield framework against companies that fail to adhere to it,” Smith said Wednesday at a U.S. Chamber of Commerce conference in Washington.

“So the renewal of that privacy shield framework is a top priority for the Federal Trade Commission and for me as the director of the bureau of consumer protection,” Smith said.

Smith's comments came a week after Commerce Secretary Wilbur Ross met with European Justice Commissioner Věra Jourová in Brussels to discuss renewing the Privacy Shield accord. The agreement, which is undergoing its second annual review, has come under criticism from E.U. lawmakers who've urged the European Commission to suspend the accord until the United States fully meets its obligations.

Smith, a former partner at Covington & Burling, highlighted enforcement actions the FTC has taken against five companies within the last year related to the Privacy Shield agreement. Those actions, Smith said, were “in support of the U.S. argument for renewal.”

In late September, the FTC reached settlements with four companies accused of falsely claiming that they had certified under the Privacy Shield. One of the companies applied in 2017 for Privacy Shield certification but never completed the necessary process, the FTC alleged. The three others had been certified through the Commerce Department's process in 2016 but allowed their certifications to lapse. Nonetheless, the FTC alleged, the three companies' websites included statements that they were participating in the data transfer program.

Two of the companies—the data analytics firm VenPath and SmartStart, a provider of employment and background screening services—were also accused of failing to affirm to the U.S. Commerce Department that they would apply Privacy Shield protections to data they'd collected while participating in the program.

An earlier settlement, reached in July, resolved claims that ReadyTech Corp., a provider of online training services, had falsely claimed on its website that the company was “in the process of certifying that we comply with the U.S.-E.U. Privacy Shield Framework.” The FTC said the company had submitted an application to the Commerce Department in 2016 but did not complete the certification process.

FTC Chairman Joseph Simons traveled last week to Brussels, where he said the agency's “commitment to the support the Privacy Shield framework is unwavering” and vowed to carry on with aggressive enforcement.

“We will continue to take action against companies that fail to honor a substantive commitment to the Privacy Shield principles, as well as those that make false claims of participation in the framework,” Simons said.

Simons, a former antitrust partner at Paul, Weiss, Rifkind, Wharton & Garrison, added that the FTC recently issued investigative demands to companies participating in the Privacy Shield agreement as part of the agency's “ongoing efforts to proactively monitor compliance.”

|